Add bounded Bash for-in analysis

[Aaronontheweb]

Summary

• parse static-value Bash for name in words; do ...; done into the v0.3 structural model
• publish bounded effective argument domains without changing compatibility Clause operands
• discover iterator substitutions and preserve loop and pipeline ancestry
• promote 12 executable corpus cases and add native Bash semantic oracles
• keep occurrence cwd unknown and fail closed on state mutation, ambiguous prior cwd, same-name nested bindings, hidden parameter execution, and unsafe pattern covers

Scope

This is the narrowed static-value Bash loop slice. OpenSpec tasks 6.5 through 6.8 remain open for structure-aware abstract state, remaining grammar coverage, and Netclaw integration. Refs #71.

Validation

• dotnet build -c Release
• dotnet test -c Release — 1,527 passed
• dotnet format --verify-no-changes --no-restore
• pwsh ./scripts/Add-FileHeaders.ps1 -Verify
• dotnet pack -c Release --no-build -o ./bin/nuget
• exact PowerShell corpus generator round-trip
• Slopwatch clean
• openspec validate v0-3-structured-shell-analysis --strict
• adversarial staged-fingerprint review: GO